Threats tagged 'ghsa-46cx-8jfv-gcg7'

abp-next-admin versions 10.4.0 through 10.7.0 have a cross-tenant authorization bypass vulnerability in the BlobManagement download-by-name endpoint. This flaw allows authenticated users to access files belonging to other tenants by supplying a victim tenantId in the request path, causing the system to switch tenant context improperly and return blobs stored by that tenant.